I am trying to configure a local DNS server in CentOS 7 and It appears that queries from the server are working to outside but clients are not getting responses from local server. I can see the request coming in via tcpdump but local server isn't performing the query and replying to client.
I expect to see a query to ext DNS and/or reply from local DNS to client.
[root@zotac etc]# cat named.conf//// named.conf//// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS// server as a caching only nameserver (as a localhost DNS resolver only).//// See /usr/share/doc/bind*/sample/ for example named configuration files.//// See the BIND Administrator's Reference Manual (ARM) for details about the// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.htmlacl "trusted" { 10.30.3.0/24;};options { //listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; allow-query { trusted; }; allow-transfer { 10.30.3.5;}; /* - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. - If you are building a RECURSIVE (caching) DNS server, you need to enable recursion. - If your recursive DNS server has a public IP address, you MUST enable access control to limit queries to your legitimate users. Failing to do so will cause your server to become part of large scale DNS amplification attacks. Implementing BCP38 within your network would greatly reduce such attack surface */ recursion yes; dnssec-enable no; dnssec-validation no; /* Path to ISC DLV key */ bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic"; pid-file "/run/named/named.pid"; session-keyfile "/run/named/session.key"; forwarders { 8.8.8.8; 8.8.4.4; }; forward first; listen-on port 53 { 10.30.3.5; };};logging { channel default_debug { file "data/named.run"; severity dynamic; };};zone "." IN { type hint; file "named.ca";};include "/etc/named.rfc1912.zones";include "/etc/named.root.key";key rndc-key { algorithm hmac-md5; secret "secretpassword"; };controls { inet 127.0.0.1 port 953 allow { 127.0.0.1; } keys { rndc-key; }; };zone "kfs.local" IN { type master; file "/var/named/kfs.local.hosts"; allow-update { none; }; };zone "10.30.3.in-addr.arpa" { type master; file "/var/named/3.30.10.rev"; };[root@zotac etc]#